Project

General

Profile

Scénario #22613

Étude Seth/FreeIPA : suite du hackathon

Added by Gilles Grandgérard over 3 years ago. Updated over 3 years ago.

Status:
Terminé (Sprint)
Priority:
Normal
Assigned To:
Category:
-
Start date:
11/23/2017
Due date:
01/26/2018
% Done:

100%

Estimated time:
(Total: 2.00 h)
Spent time:
(Total: 25.00 h)
Story points:
8.0
Remaining (hours):
0.00 hour
Velocity based estimate:
5 days

Description

Suite du hackathon

L'idée est de vérifier que l'on peut gérer plusieurs domaine AD (2 etab) avec un FreeIPA en aca

  • Monter une maquette
  • Vérifier que l'on peut se connecter depuis un PC Etab1 sur une ressource de l'Etab2 grâce à l'authentification FreeIpa
  • faire un bilan / samba :
    • GPO ?
    • trusted resource ?
NB : Cela n'a sans doute pas d'intérêt dans le cadre de ce scénario mais on me dit que Cadoles a créolisé l'outil

Profiter de ce scénario pour rédiger le [[eole-interne:Hackathon2017|CR de l'atelier]].

Extrait de conversation IRC

<nebuchadnezzar> As far as I understand the documentation, I found only scenarios where people have an AD
and plug a FreeIPA to permit some Linux workstation to access AD resources. I would like to make the other way:
1) one FreeIPA cluster with all users (feeded from an existing LDAP) 2) each site with its own samba4 AD to
manage windows resources (workstations, printers, etc) and authenticating users against the FreeIPA. This setup
is working but I wonder if I can make the Samba4 ADs see the FreeIPA users and groups to define ACLs and
GPO. To illustrate: (c.f. FreeIPA-Samba4AD.svg)
[...]
<ab> nebuchadnezzar: not supported.
<ab> nebuchadnezzar: (not supported yet). Also Samba AD DC with MIT Kerberos currently cannot trust freeIPA
due to a bug in Samba. Heimdal version sort of works.
[...]
<nebuchadnezzar> ab: thanks, does this requires something on the samba side? like making samba4 using sssd
to access FreeIPA infos?
<ab> nebuchadnezzar: there are some things missing on ipa side, some on samba.
[...]
<nebuchadnezzar> ab: OK, do you have some tikets or RFC pages to see if we can make some contribution? We
pay some developpment on the samba side, maybe we can do a little on FreeIPA side?
<ab> nebuchadnezzar: it is not a money question, we need some development forces as I'm overloaded on the AD dev front
[...]
<nebuchadnezzar> thanks, do you want me to explain our use case more clearly? Or just chating about what
need to be done and see if we can propose a patch?
<ab> yes, explain your use case
<nebuchadnezzar> OK, I'll do that
<nebuchadnezzar> thanks a lot
<ab> I know what needs to be done, I just have limited time to do it
<ab> Read this: http://talks.vda.li/2017/SambaXP/freeipa_gc.pdf
<ab> this is a presentation I made at the latest SambaXP about global catalog support in FreeIPA
<ab> this is what we are currently missing
<ab> to allow AD DCs to look up IPA users over trust

FreeIPA-Samba4AD.svg View (16 KB) Daniel Dehennin, 01/08/2018 04:20 PM


Subtasks

Tâche #22147: CR de l'atelier FreeIPAFerméGérald Schwartzmann

Tâche #22648: Remonter une maquetteFerméDaniel Dehennin

Tâche #22649: Vérifier la portée de l'authentification FreeIPAFermé

Tâche #22650: Monter en compétence sur FreeIPAFerméGérald Schwartzmann

Tâche #22753: Recontacter le développeur FreeIPAFerméDaniel Dehennin

History

#1 Updated by Gilles Grandgérard over 3 years ago

  • Description updated (diff)

#2 Updated by Gilles Grandgérard over 3 years ago

  • Story points set to 8.0

#3 Updated by Joël Cuissinat over 3 years ago

  • Description updated (diff)

#4 Updated by Daniel Dehennin over 3 years ago

#5 Updated by Daniel Dehennin over 3 years ago

  • Description updated (diff)

#6 Updated by Gérald Schwartzmann over 3 years ago

  • Subject changed from Etude Seth/FreeIPA : suite du hackathon to Étude Seth/FreeIPA : suite du hackathon

#7 Updated by Daniel Dehennin over 3 years ago

  • Description updated (diff)

#8 Updated by Daniel Dehennin over 3 years ago

  • Assigned To set to Daniel Dehennin

#9 Updated by Joël Cuissinat over 3 years ago

  • Status changed from Nouveau to Terminé (Sprint)

Also available in: Atom PDF